Docker Agent vs AI SDK

Docker Agent 70

Framework reading. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Usage telemetry is on by default, with a notice on first start and TELEMETRY_ENABLED=false to stop it. The telemetry page, moved to the configuration section by 17 October, still says command events include positional arguments, which for run and exec can include prompts, and error text (12). Four safety modes with allow, ask and deny rules, a default that asks for anything not read-only, --exec rejecting unapproved calls, --sandbox for a Docker Sandboxes VM, and HTTP MCP defaulting to loopback and restricted. Since 1.152.0 (21 October) the API server rejects cross-origin requests, checks Host on unauthenticated listeners and requires --auth-token on non-loopback ones. A run's --listen control plane still has no built-in authentication and accepts loopback addresses and local sockets only (19). The docs treat skill files and third-party configs as untrusted and restrict URI schemes against prompt injection, with no dedicated guidance page (10). Hooks for audit logging and approval decisions, opt-in OpenTelemetry traces, NDJSON transcripts and a session database (14). SECURITY.md with a 72-hour acknowledgement, a valid security.txt on docker.com (expires 2030-01-01, re-read on 1 November), two advisories published on GitHub with fixed versions, and CodeQL and zizmor in CI. No paid bounty, and we saw no CVE identifiers on the advisories. The advisories page answered 403 on 1 November, the GitHub advisory database held no new docker-agent entry from August to November, and OSV lists none for the Go module. 1.152.0 updates Go to 1.27.3 for its security fixes and locks down the REST API against CSRF and DNS rebinding, with no advisory found for the latter (15). SOC 2 isn't scored for a framework.

AI SDK 90

No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.

Docker Agent 81

Framework reading, scored on what an agent with MCP needs. The README's agent with one MCP server is eight lines of YAML and no code, with deferred toolsets and a code mode (23). Budgets cap cost, tokens and time, tool results are bounded to 50 KiB since 1.148.0, and context is compacted, but max_iterations is unlimited and no budget applies unless declared (16). --json writes one NDJSON event per message, tool call and error, and the API documents 404, 409, 413 and 502 responses. No exit-code reference found for run --exec (14). Sessions resume from SQLite, the event stream replays from a sequence number, follow-ups accept an Idempotency-Key, and read-only and destructive tool annotations drive the safety modes (18). One binary and a model key or a local model are enough to start. The library is Go only (10).

AI SDK 95

An MCP client in a few lines with createMCPClient and client.tools(), and tool search with deferLoading keeps unused tool definitions out of the prompt (25). stopWhen with a default of 20 steps, and prepareStep to trim messages, switch models or limit active tools per step (20). 38 typed errors with isInstance guards, and MCP results with isError go back to the model (20). maxRetries on model calls, opt-in retries for transient MCP failures only, and WorkflowAgent for durable steps with automatic retries (20). Few required parameters, but TypeScript only, and a string model ID needs an AI Gateway key unless a default provider is set (10).

Docker Agent 90

Framework reading. agent-schema.json in the repository is a JSON Schema for the whole config, and the chat server serves its OpenAPI document at /openapi.json. We found no OpenAPI document for the native /api server and didn't check the Go package reference (22). llms.txt on docker.github.io/docker-agent and on docs.docker.com (10). The docs say when to use the API server and when the chat server, compare six ways to pass large input, and state that permissions aren't a security boundary (17). Configs are parsed strictly, unknown fields fail to load with a hint, and safety fields accept four named modes only (13). An examples directory, a troubleshooting page of common errors and documented HTTP status codes for the API. We found no exit-code reference for run --exec (13). A dated CHANGELOG.md and a numbered config schema, now version 16, with migration on load (15).

AI SDK 100

Typed TypeScript API with a reference section for every function (25). llms.txt and a Markdown copy of each page (10). The docs say when to use each piece, such as a table of WorkflowAgent against ToolLoopAgent, a when-to-use section for subagents and harnesses, and HTTP over stdio for MCP in production (20). Tools take Zod or JSON Schema inputs (15). 38 error types documented in the reference, with error-handling guides and examples throughout (15). Versioning page and a changesets CHANGELOG per package (15).

Docker Agent 81

Apache-2.0 (30). The telemetry page lists what's collected and warns that arguments and error text can carry secrets or personal data. It doesn't name the endpoint (api.docker.com, per the source), link Docker's privacy policy or give a retention period, unchanged on 17 October (15). Breaking changes are dated in the changelog and one renamed variable kept a fallback for one release, with no written deprecation policy, and the changelog says frozen config schema versions aren't maintained long-term (10). Telemetry is disclosed in the README, the docs and a first-start notice, with an opt-out variable (20).

AI SDK 89

Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).

Docker Agent 88

Read with the local-software lines, because the owner runs it. Binaries for macOS, Linux and Windows on amd64 and arm64 on every GitHub release, a Homebrew formula at 1.154.0 on 1 November, a Docker Hub image updated on 31 October, and Docker Desktop 4.63 and later bundle it. Go 1.27 is the stated minimum for source builds (20). The ci workflow runs on every push to main with about 1,350 test files and an e2e directory. Nine of the last ten push runs passed on 8 October, per the 8 October check, not re-read on 1 November (25). 25 open issues and 17 open pull requests on 8 October, most labelled and answered, with open reports of a race in transfer_task (#4156), a hand-off dropped silently (#4242) and edit_file editing the first of several matches (#3929), per the 8 October check, not re-read on 1 November (20). The changelog has Breaking Changes sections, but those changes ship in minor releases (1.114.0, 1.133.0 and 1.137.0 since July) and the major version has never moved. Since then 1.152.0 (21 October) made --auth-token mandatory on non-loopback API listeners under Bug Fixes, and 1.153.0 (28 October) removed MCP sampling, roots and logging support under Technical Changes and changed Go runtime packages in commits marked !, none of them in a Breaking Changes section (8). 1.154.0, past 1.0 (15).

AI SDK 93

Official npm packages, with ai 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.